Podcast
Root Causes 362: When You're Attacked by a State Actor


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
February 13, 2024
In this episode we share the details of a recent nation state actor attack on Microsoft and some of the lessons learned.
Podcast Transcript
Lightly edited for flow and brevity.
But I think what is really interesting here, Tim, is I think there is some homework. I think that there is some very low hanging fruit. And I think that there's a big lesson here. A lot of this we've talked about before, but it's always good to rethink about these things and realize, even a company the size of Microsoft has not completely locked themselves down. And you know, Tim, I still talk to sometimes large enterprises, small enterprises, and a lot of them think, well, this is covered my security team has got this. Well, no, you probably don't. So there's lessons to be learned. So let's do it. Let's go through it.
So the bad guy used a spray and pray type of attack. This is according to Microsoft. And were successful in compromising this nonproduction tenant server. And you know, there's some things, there's a few things there. One is passwords, guys. Passwords. Right?
Basically, one of these servers that was just sitting off on the side, you know, it’s probably a server from back in the day even before MFA was implemented, or even available, and it was just forgotten about, and well, who cares about that server. And, you know, guys, bad guys know how to do lateral attacks. Even if you don't have the skills the bad guys do. So if you're putting a system that's publicly, it's publicly exposed to the internet, that does not have a more advanced form of authentication, and you expect that the bad guy cannot figure out security through obscurity, how to move laterally, and, you know, develop the privileges within that environment to be able to walk around, these are big, big mistakes that, as you can see, even Microsoft makes. And look, this blog is great. Microsoft is being fully open in what's happened here. They completely opened the kimono, and it's for all of us to learn. I highly recommend everybody read this. But guys, that's the lowest hanging fruit right there.
And now, you know, what they're calling it here, basically, is the utilization of residential proxy networking, right. Residential proxy, which basically means that the bad guy is coming in at a whole pile of different IP addresses. So if you're attempting to block list based on IP addresses, forget about it. You're not helping yourself. If you think that that's some form of defense, I got news for you, the bad guys, especially, especially the nation state attackers that, you know, from the jurisdiction, these guys are specialists in being able to swap their IP addresses very quickly. And so this was part of how the bad guys were able to obfuscate in their lateral movements.
But I would say that the rest of the story, you know, there's a lot of really good technical information, things you should be listening to in that blog but it really comes down to context is everything. And so you gotta ask yourself the soul searching question - is your network or other computer systems too trusting, too open and allows too many conditions? Let's talk about OAuth for a sec, Tim.
Now, obviously, the people at the very center of this could argue it. Hey, you know, get on the podcast, talk to us about it. But that's my take when I read the blog, Tim.
And again, I'm gonna point right back to what I talked about the beginning of the podcast, the lowest hanging fruit, go do it now. For the love of everything, go take inventory of all of your publicly exposed assets. What are the ones that have an authentication mechanism that is just passwords? Write those down on a piece of paper and ask yourself the tough question - can I mitigate this with a better piece of authentication Technology, A? or B, can I just shut it down? Do I really need this to be on? And then the other question is, ok, if all else fails, I can't shut it down, and I can't install a better technology, then you better be monitoring that system, because it's gonna get prayed and sprayed by cozy bear and other people you don't want in your network.

